Question

I am working on a project which includes image gallery.Now I want to store number of clicks/counts value into my database(developed in MySQL). I tried to do it in my own way, but problem is count/clicks value for all the images are stored in the database as same value.

The code given below is in the file main.php which displays images that is retrieved from database.The picture.php is the one that retrieves images from database. I have appended the code to count the number of clicks in picture.php so that it counts whenever the image is clicked.

main.php

    $query="SELECT * FROM files";
    $result=mysql_query($query) or die(mysql_error());
    while($fetch=mysql_fetch_array($result)){
         echo "<div class=single>
               <div class=wrap>
                   <a href=picture.php?fid=".$offer_id.">
                       <img src=picture.php?fid=".$offer_id."\">
                   </a>
               </div>
               </div>";
    }

picture.php

    if(isset($_GET['fid']))
    {
         include "connect.php";
         $fid=$_GET['fid'];
         $query="SELECT * FROM offers_em WHERE o_id =$fid";
         $result=mysql_query($query) or die(mysql_error());

         $sql="UPDATE offers_em SET count+=1 WHERE o_id=".$fid;
         $sql2=mysql_query($sql);
         
         $name=mysql_result($result,0,"pic_name");
         $size=mysql_result($result,0,"size");
         $type=mysql_result($result,0,"type");
         $content=mysql_result($result,0,"content");
   
         header("Content-Disposition: attachment; filename=$name");
         header("Content-length: $size");
         header("Content-type: $type");
         echo $content;
    }
    else{
         die("No file ID given...");
    }

Answer 1

It has nothing to do with SQL injection.

The problem is I’m calling the link in a loop,hence all the clicks values are getting updated.So i created a different count_link.php file and it will be called only when user click the image link.

$query="SELECT * FROM files";
    $result=mysql_query($query) or die(mysql_error());
    while($fetch=mysql_fetch_array($result)){
         echo "<div class=single>
               <div class=wrap>
                   <a href=count_link.php?fid=".$offer_id.">
                       <img src=picture.php?fid=".$offer_id."\">
                   </a>
               </div>
               </div>";
    }

Anyways thanks for you time guys..:)